Welcome to Geeklog Tuesday, November 21 2017 @ 08:46 am EST

Geeklog 1.6.0sr1 and 1.5.2sr5

  • Contributed by:
  • Views: 6,541
Security

Geeklog 1.6.0sr1 and 1.5.2sr5 address the following security issues:

  1. Gerendi Sandor Attila reported an XSS in the forms to email a user and to email a story to a friend.
  2. The "Mail Story to a Friend" function didn't check story permissions, so that it was possible to email a story even if you didn't have the permissions to view it on the site.

For Geeklog 1.6.0, we also fixed two bugs (an SQL error when the story submission queue was off and a call to a nonexistent function).

The following files are available: